Executive brief
Zalando Skipper is an HTTP router and reverse proxy for service composition. A security flaw in its route server component allows any application within the same Kubernetes cluster to access sensitive infrastructure data without authentication. An attacker who compromises a single low-privilege application could use this to map out the entire network, identify internal service locations, and potentially access session or rate-limiting data in Redis or Valkey caches.
Technical details
The `routesrv` component in Zalando Skipper fails to implement authentication for its HTTP API endpoints, including `/routes`, `/swarm/redis/shards`, and `/swarm/valkey/shards`. Because the component runs with cluster-wide RBAC permissions to aggregate Ingress and RouteGroup data, it inadvertently exposes this sensitive information to any client that can reach its predictable Kubernetes DNS name. An attacker with a foothold in any pod within the cluster can bypass namespace-level isolation to perform reconnaissance on internal service URLs, filter chains (including OAuth/JWT policies), and cache shard addresses. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). A fix is available in version 0.27.13, which introduces authentication capabilities for the route server.
Affected products
- Zalando skipper < 0.27.13
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: Version 0.27.13 released
- 2026-07-17: advisory